Workflow wise, you should just do all of the .env configurations while SSH'd to do passwords and such. It doesn't make sense to break it up into a separate step when you're already in the box for things like password configuration.
After all, you don't need to install the loader to set this up!
If it helps, I plan to do this as part of #1377 (closed) since I won't be able to ignore it when I'm amending the docs. It's just slightly different scope which is why I separated it into a separate ticket.